Skip to content

Commit

Permalink
MDL-16668 import htmlpurifier 3.1.1 to HEAD
Browse files Browse the repository at this point in the history
  • Loading branch information
skodak committed Sep 24, 2008
1 parent 165a2c9 commit 67d7aa4
Show file tree
Hide file tree
Showing 70 changed files with 1,437 additions and 288 deletions.
6 changes: 3 additions & 3 deletions lib/htmlpurifier/HTMLPurifier.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
*/

/*
HTML Purifier 3.1.0 - Standards Compliant HTML Filtering
HTML Purifier 3.1.1 - Standards Compliant HTML Filtering
Copyright (C) 2006-2008 Edward Z. Yang
This library is free software; you can redistribute it and/or
Expand Down Expand Up @@ -55,10 +55,10 @@ class HTMLPurifier
{

/** Version of HTML Purifier */
public $version = '3.1.0';
public $version = '3.1.1';

/** Constant with version of HTML Purifier */
const VERSION = '3.1.0';
const VERSION = '3.1.1';

/** Global configuration object */
public $config;
Expand Down
14 changes: 10 additions & 4 deletions lib/htmlpurifier/HTMLPurifier.safe-includes.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@
require_once $__dir . '/HTMLPurifier/CSSDefinition.php';
require_once $__dir . '/HTMLPurifier/ChildDef.php';
require_once $__dir . '/HTMLPurifier/Config.php';
require_once $__dir . '/HTMLPurifier/ConfigDef.php';
require_once $__dir . '/HTMLPurifier/ConfigSchema.php';
require_once $__dir . '/HTMLPurifier/ContentSets.php';
require_once $__dir . '/HTMLPurifier/Context.php';
Expand All @@ -46,6 +45,7 @@
require_once $__dir . '/HTMLPurifier/Injector.php';
require_once $__dir . '/HTMLPurifier/Language.php';
require_once $__dir . '/HTMLPurifier/LanguageFactory.php';
require_once $__dir . '/HTMLPurifier/Length.php';
require_once $__dir . '/HTMLPurifier/Lexer.php';
require_once $__dir . '/HTMLPurifier/PercentEncoder.php';
require_once $__dir . '/HTMLPurifier/Strategy.php';
Expand All @@ -60,12 +60,14 @@
require_once $__dir . '/HTMLPurifier/URIParser.php';
require_once $__dir . '/HTMLPurifier/URIScheme.php';
require_once $__dir . '/HTMLPurifier/URISchemeRegistry.php';
require_once $__dir . '/HTMLPurifier/UnitConverter.php';
require_once $__dir . '/HTMLPurifier/VarParser.php';
require_once $__dir . '/HTMLPurifier/VarParserException.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Enum.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Integer.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Lang.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Switch.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Text.php';
require_once $__dir . '/HTMLPurifier/AttrDef/URI.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Number.php';
Expand Down Expand Up @@ -110,6 +112,9 @@
require_once $__dir . '/HTMLPurifier/AttrTransform/Lang.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Length.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Name.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/SafeEmbed.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/SafeObject.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/SafeParam.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/ScriptRequired.php';
require_once $__dir . '/HTMLPurifier/ChildDef/Chameleon.php';
require_once $__dir . '/HTMLPurifier/ChildDef/Custom.php';
Expand All @@ -118,9 +123,6 @@
require_once $__dir . '/HTMLPurifier/ChildDef/Optional.php';
require_once $__dir . '/HTMLPurifier/ChildDef/StrictBlockquote.php';
require_once $__dir . '/HTMLPurifier/ChildDef/Table.php';
require_once $__dir . '/HTMLPurifier/ConfigDef/Directive.php';
require_once $__dir . '/HTMLPurifier/ConfigDef/DirectiveAlias.php';
require_once $__dir . '/HTMLPurifier/ConfigDef/Namespace.php';
require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator.php';
require_once $__dir . '/HTMLPurifier/DefinitionCache/Null.php';
require_once $__dir . '/HTMLPurifier/DefinitionCache/Serializer.php';
Expand All @@ -138,6 +140,8 @@
require_once $__dir . '/HTMLPurifier/HTMLModule/Presentation.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Proprietary.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Ruby.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/SafeEmbed.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/SafeObject.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Scripting.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/StyleAttribute.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Tables.php';
Expand All @@ -153,6 +157,7 @@
require_once $__dir . '/HTMLPurifier/Injector/AutoParagraph.php';
require_once $__dir . '/HTMLPurifier/Injector/Linkify.php';
require_once $__dir . '/HTMLPurifier/Injector/PurifierLinkify.php';
require_once $__dir . '/HTMLPurifier/Injector/SafeObject.php';
require_once $__dir . '/HTMLPurifier/Lexer/DOMLex.php';
require_once $__dir . '/HTMLPurifier/Lexer/DirectLex.php';
require_once $__dir . '/HTMLPurifier/Strategy/Composite.php';
Expand All @@ -173,6 +178,7 @@
require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternalResources.php';
require_once $__dir . '/HTMLPurifier/URIFilter/HostBlacklist.php';
require_once $__dir . '/HTMLPurifier/URIFilter/MakeAbsolute.php';
require_once $__dir . '/HTMLPurifier/URIFilter/Munge.php';
require_once $__dir . '/HTMLPurifier/URIScheme/ftp.php';
require_once $__dir . '/HTMLPurifier/URIScheme/http.php';
require_once $__dir . '/HTMLPurifier/URIScheme/https.php';
Expand Down
11 changes: 4 additions & 7 deletions lib/htmlpurifier/HTMLPurifier/AttrDef.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -51,16 +51,13 @@ abstract public function validate($string, $config, $context);
*
* @warning This processing is inconsistent with XML's whitespace handling
* as specified by section 3.3.3 and referenced XHTML 1.0 section
* 4.7. Compliant processing requires all line breaks normalized
* to "\n", so the fix is not as simple as fixing it in this
* function. Trim and whitespace collapsing are supposed to only
* occur in NMTOKENs. However, note that we are NOT necessarily
* parsing XML, thus, this behavior may still be correct.
* 4.7. However, note that we are NOT necessarily
* parsing XML, thus, this behavior may still be correct. We
* assume that newlines have been normalized.
*/
public function parseCDATA($string) {
$string = trim($string);
$string = str_replace("\n", '', $string);
$string = str_replace(array("\r", "\t"), ' ', $string);
$string = str_replace(array("\n", "\t", "\r"), ' ', $string);
return $string;
}

Expand Down
8 changes: 8 additions & 0 deletions lib/htmlpurifier/HTMLPurifier/AttrDef/CSS.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,12 @@ public function validate($css, $config, $context) {
$declarations = explode(';', $css);
$propvalues = array();

/**
* Name of the current CSS property being validated.
*/
$property = false;
$context->register('CurrentCSSProperty', $property);

foreach ($declarations as $declaration) {
if (!$declaration) continue;
if (!strpos($declaration, ':')) continue;
Expand Down Expand Up @@ -61,6 +67,8 @@ public function validate($css, $config, $context) {
$propvalues[$property] = $result;
}

$context->destroy('CurrentCSSProperty');

// procedure does not write the new CSS simultaneously, so it's
// slightly inefficient, but it's the only way of getting rid of
// duplicates. Perhaps config to optimize it, but not now.
Expand Down
38 changes: 32 additions & 6 deletions lib/htmlpurifier/HTMLPurifier/AttrDef/CSS/FontFamily.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ public function validate($string, $config, $context) {
'cursive' => true
);

$string = $this->parseCDATA($string);
// assume that no font names contain commas in them
$fonts = explode(',', $string);
$final = '';
Expand All @@ -35,13 +34,40 @@ public function validate($string, $config, $context) {
$quote = $font[0];
if ($font[$length - 1] !== $quote) continue;
$font = substr($font, 1, $length - 2);
// double-backslash processing is buggy
$font = str_replace("\\$quote", $quote, $font); // de-escape quote
$font = str_replace("\\\n", "\n", $font); // de-escape newlines

$new_font = '';
for ($i = 0, $c = strlen($font); $i < $c; $i++) {
if ($font[$i] === '\\') {
$i++;
if ($i >= $c) {
$new_font .= '\\';
break;
}
if (ctype_xdigit($font[$i])) {
$code = $font[$i];
for ($a = 1, $i++; $i < $c && $a < 6; $i++, $a++) {
if (!ctype_xdigit($font[$i])) break;
$code .= $font[$i];
}
// We have to be extremely careful when adding
// new characters, to make sure we're not breaking
// the encoding.
$char = HTMLPurifier_Encoder::unichr(hexdec($code));
if (HTMLPurifier_Encoder::cleanUTF8($char) === '') continue;
$new_font .= $char;
if ($i < $c && trim($font[$i]) !== '') $i--;
continue;
}
if ($font[$i] === "\n") continue;
}
$new_font .= $font[$i];
}

$font = $new_font;
}
// $font is a pure representation of the font name

if (ctype_alnum($font)) {
if (ctype_alnum($font) && $font !== '') {
// very simple font, allow it in unharmed
$final .= $font . ', ';
continue;
Expand All @@ -50,8 +76,8 @@ public function validate($string, $config, $context) {
// complicated font, requires quoting

// armor single quotes and new lines
$font = str_replace("\\", "\\\\", $font);
$font = str_replace("'", "\\'", $font);
$font = str_replace("\n", "\\\n", $font);
$final .= "'$font', ";
}
$final = rtrim($final, ', ');
Expand Down
56 changes: 25 additions & 31 deletions lib/htmlpurifier/HTMLPurifier/AttrDef/CSS/Length.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,46 +6,40 @@
class HTMLPurifier_AttrDef_CSS_Length extends HTMLPurifier_AttrDef
{

/**
* Valid unit lookup table.
* @warning The code assumes all units are two characters long. Be careful
* if we have to change this behavior!
*/
protected $units = array('em' => true, 'ex' => true, 'px' => true, 'in' => true,
'cm' => true, 'mm' => true, 'pt' => true, 'pc' => true);
/**
* Instance of HTMLPurifier_AttrDef_Number to defer number validation to
*/
protected $number_def;
protected $min, $max;

/**
* @param $non_negative Bool indication whether or not negative values are
* allowed.
* @param HTMLPurifier_Length $max Minimum length, or null for no bound. String is also acceptable.
* @param HTMLPurifier_Length $max Maximum length, or null for no bound. String is also acceptable.
*/
public function __construct($non_negative = false) {
$this->number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative);
public function __construct($min = null, $max = null) {
$this->min = $min !== null ? HTMLPurifier_Length::make($min) : null;
$this->max = $max !== null ? HTMLPurifier_Length::make($max) : null;
}

public function validate($length, $config, $context) {

$length = $this->parseCDATA($length);
if ($length === '') return false;
if ($length === '0') return '0';
$strlen = strlen($length);
if ($strlen === 1) return false; // impossible!

// we assume all units are two characters
$unit = substr($length, $strlen - 2);
if (!ctype_lower($unit)) $unit = strtolower($unit);
$number = substr($length, 0, $strlen - 2);
public function validate($string, $config, $context) {
$string = $this->parseCDATA($string);

if (!isset($this->units[$unit])) return false;
// Optimizations
if ($string === '') return false;
if ($string === '0') return '0';
if (strlen($string) === 1) return false;

$number = $this->number_def->validate($number, $config, $context);
if ($number === false) return false;
$length = HTMLPurifier_Length::make($string);
if (!$length->isValid()) return false;

return $number . $unit;
if ($this->min) {
$c = $length->compareTo($this->min);
if ($c === false) return false;
if ($c < 0) return false;
}
if ($this->max) {
$c = $length->compareTo($this->max);
if ($c === false) return false;
if ($c > 0) return false;
}

return $length->toString();
}

}
Expand Down
4 changes: 4 additions & 0 deletions lib/htmlpurifier/HTMLPurifier/AttrDef/CSS/Number.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,10 @@ public function __construct($non_negative = false) {
$this->non_negative = $non_negative;
}

/**
* @warning Some contexts do not pass $config, $context. These
* variables should not be used without checking HTMLPurifier_Length
*/
public function validate($number, $config, $context) {

$number = $this->parseCDATA($number);
Expand Down
5 changes: 4 additions & 1 deletion lib/htmlpurifier/HTMLPurifier/AttrDef/CSS/TextDecoration.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,13 @@ public function validate($string, $config, $context) {
static $allowed_values = array(
'line-through' => true,
'overline' => true,
'underline' => true
'underline' => true,
);

$string = strtolower($this->parseCDATA($string));

if ($string === 'none') return $string;

$parts = explode(' ', $string);
$final = '';
foreach ($parts as $part) {
Expand Down
15 changes: 14 additions & 1 deletion lib/htmlpurifier/HTMLPurifier/AttrDef/HTML/Pixels.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,12 @@
class HTMLPurifier_AttrDef_HTML_Pixels extends HTMLPurifier_AttrDef
{

protected $max;

public function __construct($max = null) {
$this->max = $max;
}

public function validate($string, $config, $context) {

$string = trim($string);
Expand All @@ -24,11 +30,18 @@ public function validate($string, $config, $context) {
// crash operating systems, see <http://ha.ckers.org/imagecrash.html>
// WARNING, above link WILL crash you if you're using Windows

if ($int > 1200) return '1200';
if ($this->max !== null && $int > $this->max) return (string) $this->max;

return (string) $int;

}

public function make($string) {
if ($string === '') $max = null;
else $max = (int) $string;
$class = get_class($this);
return new $class($max);
}

}

32 changes: 32 additions & 0 deletions lib/htmlpurifier/HTMLPurifier/AttrDef/Switch.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
<?php

/**
* Decorator that, depending on a token, switches between two definitions.
*/
class HTMLPurifier_AttrDef_Switch
{

protected $tag;
protected $withTag, $withoutTag;

/**
* @param string $tag Tag name to switch upon
* @param HTMLPurifier_AttrDef $with_tag Call if token matches tag
* @param HTMLPurifier_AttrDef $without_tag Call if token doesn't match, or there is no token
*/
public function __construct($tag, $with_tag, $without_tag) {
$this->tag = $tag;
$this->withTag = $with_tag;
$this->withoutTag = $without_tag;
}

public function validate($string, $config, $context) {
$token = $context->get('CurrentToken', true);
if (!$token || $token->name !== $this->tag) {
return $this->withoutTag->validate($string, $config, $context);
} else {
return $this->withTag->validate($string, $config, $context);
}
}

}
Loading

0 comments on commit 67d7aa4

Please sign in to comment.